1. Field of Art
The invention generally relates to electronic authentication, and more specifically, to secure authentication using biometric verification.
2. Description of the Related Art
Optimizing sales transactions and providing secure access to physical and/or digital assets are challenges faced by many businesses and organizations. Ensuring these processes are safe, efficient and simple is important to merchants, providers, users and consumers alike. Conventionally, technologies such as magnetic cards (e.g., credit cards, debit cards, ATM cards, and employee badges) have been used in attempt to address these needs. More recently, various contactless cards or tokens requiring placement near compatible readers have been used.
Each of these technologies, however, has inherent problems in providing secure transaction processing and access control. In particular, the conventional technologies fail to sufficiently ensure that individuals attempting to perform a transaction are associated with the access device and are authorized to do so. Conventional attempts to address this issue include requiring users to provide Personal Identification Numbers (PINs) or passwords in conjunction with account numbers. While in some instances, these options have helped to combat fraudulent activity, these solutions add unwanted complexity and delay to transactions. With the growing need to memorize various PINs and passwords, individuals tend to repeatedly use the same, simple phrase to protect many items, or worse, keep the written phrases in their purse/wallet or next to their computer. Thus, the use of PINs and passwords are often defeated.
A technology better suited to address the issue of authenticating users is biometrics. In biometric authentication, physical and/or behavioral characteristics of an individual are analyzed to uniquely identify the individual. For example, biometric characteristics can include fingerprint, retinal, iris, face, palm, DNA, voice or signature characteristics that can each be uniquely associated with the individual. However, traditional biometric authentication solutions also suffer from significant problems. First, traditional biometric authentication techniques typically expose the participating parties to serious liabilities, risks and inefficiencies. Conventional biometric authentication techniques nearly always require users to release personal, private and unchangeable data to a controlling-entity (e.g., a merchant or business authority) or to a third-party relied upon by the controlling-entity. This exposes an individual's personal biometric information to the possibility of theft and fraudulent use. Further, controlling entities must either assume the risks and liabilities of storing this data, or trust the data to a third-party's care.
Second, conventional biometric authentication techniques generally require an individual to submit biometric information (e.g., a fingerprint, retinal scan, facial scan, or signature) for storage in a database that can then be later used for comparison with biometric data acquired at the point of transaction. This “enrollment” process is time-consuming, risky, error-prone and considered intrusive by many individuals. Further, the enrollment process must be repeated for each individual for every intended use. For example, a user may need to enroll for biometric authentication with his/her company (e.g., for secure access to facilities or digital files), and separately enroll with various merchants using biometric authentication for transactions. Thus, the individual has to spend significant time completing each separate enrollment, and additionally must trust each entity with his/her personal biometric information. For these reasons alone many individuals do not even consider these options.
The above-defined issues represent serious roadblocks to the widespread deployment and acceptance of conventional biometric authentication options. Unless the identified deficiencies are addressed, the full potential of biometric solutions will never be realized. Therefore, a new technology is needed that provides highly reliable, safe and efficient secure authentication for transaction-processing and/or access control. Moreover, the new technology should allow for a simple and efficient enrollment process that does not put an individual's highly personal information at risk of identity theft or other fraudulent use.